MITIGATING RISKS OF COUNTERFEIT AND TAINTED COMPONENTS

Abstract. Success of the mission should be the focus of software and supply chain assurance activities regardless of what activity produces the risk. It does not matter if a malicious saboteur is the cause. It does not matter if it is malicious logic inserted at the factory or inserted through an update after fielding. It does not matter if it comes from an error in judgment or from a failure to understand how an attacker could exploit a software feature. Issues from bad software hygiene, like inadvertent coding flaws or weak architectural constructs are as dangerous to the mission as malicious acts. Enormous energies are put into hygiene and quality in the medical and food industries to address any source of taint. Similar energies need to be applied to software and hardware. Until both malicious and non-malicious aspects of taint can be dealt with in ways that are visible and verifiable, there will be a continued lack of confidence and assurance in delivered capabilities throughout their lifecycle. Bad Hygiene is as Dangerous to the Mission as Malicious Intent During the past several decades, software-based ICT capa-bilities have become the basis of almost every aspect of today’s cyber commerce, governance, national security, and recreation. Software-based devices are in our homes, vehicles, commu-nications, and toys. Unfortunately software, the basis of these cyber capabilities, can be unpredictable since there are now underlying rules software has to follow as opposed to the rest of our material world which is constrained by the laws of gravity, chemistry, and physics with core factors like Plank’s Constant. This is even more true given the variety and level of skills and training of those who create and evolve cyber capabilities. The result is that for the foreseeable future there will remain a need to address the types of quality and integrity problems that leave software unreliable, attackable, and brittle directly. This includes addressing the problems that allow malware and exploitable vulnerabilities to be accidentally inserted into products dur-ing development, packaging, or updates due to poor software hygiene practices. Computer language specifications are historically vague an